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Amendments to the Claims; This listing of claims will replace all prior versions, and listings, 
of claims in the application 

Listing of Claims: 

1. (Canceled). 

2. (Canceled). 

3. (Previously Presented) A method comprising the steps of: 

(a) receiving first data from a first communication line; 

(b) segregating the first data into packets; 

(c) generating a statistic corresponding to packets received during each of a 
plurality of successive first time periods, the first time periods having a first duration value; 

(d) separately storing the generated statistics for each of the plurality of 
successive first time periods; and 

(e) generating a further statistic by aggregating the plurality of stored statistics. 

4. (Previously Presented) The method according to claim 3 comprising: 
selecting packets based on a respective type wherein the statistics generated in 

step (c) correspond to the selected packets; 

associating a respective index with each packet; 

converting each packet into a respective record including each packet's 
respective index; and 

storing the records. 

5. (Previously Presented) The method according to claim 4 further comprising the 
steps of: 

receiving a second duration value corresponding to a second time period longer 
than the first time period; and 

generating the further statistic corresponding to packets received during the 
second time period encompassing at least one first time period using at least one of the stored 
records and the stored statistics corresponding to packets received during the second time 
period. 
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6. (Previously Presented) The method according to claim 3 wherein the statistic 
includes at least one of a number of bits, a number of bytes, a number of packets, a number 
of packets of a predetermined protocol, a number of packets of a predetermined protocol 
layer, a number of packets having a predetermined source address, and a number of packets 
having a predetermined destination address of a respective packet. 

7. (Previously Presented) The method according to claim 4 wherein a record 
includes a portion of said record's respective packet plus said packet's respective index. 

8. (Previously Presented) The method according to claim 4 wherein the respective 
index of a packet corresponds to a time when the packet was received. 

9. (Previously Presented) A method according to claim 8 further comprising the 
steps of receiving a time signal from a global positioning satellite and generating the time 
when the packet was received based on the absolute time. 

10. (Previously Presented) A method according to claim 3 wherein the received 
packets originated from a second communication line and each received packet includes an 
indication of a respective first time corresponding to transmission of said packet on the second 
communication line, the method further comprising: 

determining a respective second time when each packet is received from the 
first communication line; and 

calculating a transmission delay corresponding to each packet by subtracting 
said packet's respective second time from said packet's respective first time. 

11. (Previously Presented) A method according to claim 10 wherein the 
transmission delay corresponding to each packet is calculated based on a time the packet is 
detected on the first communication line, a time the packet is detected on the second 
communication line, a rate of data transmission on the first communication line, and a length 
of the packet on the first communication line. 
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12. (Original) The method according to claim 3 wherein step (a) includes receiving 
the first data from the first communication line using a non-intrusive coupling to the first 
communication line. 

13. (Previously Presented) The method according to claim 4 further comprising 
the step of receiving information indicating at least one of a type of packets to be selected, 
the first duration value, and an identification of the statistics to generate in step (c). 

14. (Original) The method according to claim 13 wherein the information is 
received via the first communication line. 

15. (Canceled). 

16. (Original) A method according to claim 10 including the step of receiving a 
time signal from a global positioning satellite for determining the second time. 

17. (Previously Presented) A method according to claim 4 wherein step (c) 
includes generating at least one quality of service value for each successive time period 
corresponding to packets of a predetermined packet type received during each respective 
successive time period. 

18. (Original) A method according to claim 17 wherein the at least one quality of 
service value indicates at least one of a round trip delay and a retransmit rate corresponding 
to the packets of the predetermined packet type received during the respective successive 
time period. 

19. (Previously Presented) A method according to claim 3 comprising determining 
a respective type of each packet based on at least one of a corresponding application type, a 
corresponding packet content, a packet source, and a packet destination for selecting packets 
based on the respective type. 

20. (Previously Presented) A method according to claim 3 wherein the first 
communication line is in a network including a user and step (c) includes generating at least 
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one user profiling statistic for each successive time period corresponding to packets destined 
to or from a user which are received during each respective successive time period. 

21. (Original) A method according to claim 20 wherein the at least one user 
profiling statistic is generated using the records stored in the memory. 

22. (Previously Presented) A method according to claim 3 further comprising the 
step of receiving an input from a user identifying a user statistic and step (c) includes 
generating the identified user statistic. 

23. (Previously Presented) A method according to claim 3 further comprising the 
steps of: 

receiving an input from a user identifying a user statistic; and 
generating the identified user statistic using at least one of the stored statistics 
and the stored records. 

24. (Original) A method according to claim 3 wherein the first data is transmitted 
on the first communication line according to a first protocol, the method further comprising 
the step of receiving decoding parameters corresponding to the first protocol and step (a) 
includes receiving the first data according to the decoding parameters and step (b) includes 
segregating the received first data into packets according to the decoding parameters. 

25. (Previously Presented) A method according to claim 3 comprising: 

counting packets of each a plurality of packet types received during each of the 
successive first time periods; and 

displaying the plurality of packet types and their corresponding counts 
accumulated over a second time period greater than the first time period in a first portion of a 
display area of a display device. 

26. (Previously Presented) A method according to claim 25 wherein the plurality of 
packet types are selectable by a user and the method comprises receiving a user selection of 
one of the packet types by a user and displaying statistics corresponding to packets of the 
selected packet type received during the second time period. 
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27. (Original) A method according to claim 25 further comprising the step of 
graphically displaying the statistics corresponding to the plurality of packet types in a plot 
over the second time period in a second portion of the display area. 

28. (Original) A method according to claim 25 further comprising the step of: 
generating a graphical display of the statistics corresponding to the plurality of packet types in 
a plot ranging over the second time period in a second portion of the display area, wherein the 
plot includes a plurality of discrete selectable time periods; receiving a user selection of a 
range of the plurality of discrete selectable time periods; updating the graphical display to 
display statistics corresponding to the selected time periods. 

29. (Previously Presented) A method according to claim 4 further comprising the 
steps of: identifying packets belonging to a data stream; storing stream identification 
information as one of a separate record and a separate field in the records corresponding to 
the identified packets. 

30. (Original) A method according to claim 29 further comprising the step of 
recreating the data stream using the stored records and the stored stream identification 
information. 



31. (Previously Presented) A method according to claim 4 wherein 

the first communication line is in a network including a second communication 

line, 

the respective index associated with each selected packet includes said packet's 
respective time value, and 

step each record includes a uniquely identifiable portion of the respective 
selected packet; and 

the method further comprises the steps of: 

receiving second data from the second communication line; 

segregating the second data into packets; 

selecting packets received from the second communication line based on a 
respective type of each packet; 
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determining a respective time value corresponding to a time when each of the 
selected packets received from the second communication line was received; 

associating a respective index with each of the selected packets received from 
the second communication line, the respective index including the respective time value; 

converting each of selected packets received from the second communication 
line into a respective record that includes a uniquely identifiable portion the selected packet 
from the second communication line and includes said packet's respective index; 

storing the records corresponding to the selected packets received from the 
second communication line; 

comparing the uniquely identifiable portions of packets received from the first 
communication line to the uniquely identifiable portions of packets received from the second 
communication line to determine which selected packets received from the first 
communication line correspond to packets received from the second communication line to 
generate matched pairs of packets; 

generating a transmission delay corresponding to each matched pair of packets using 
their respective indexes. 

32. (Original) The method according to claim 31 wherein the transmission delay for 
a particular matched packet is calculated based on a time of receipt of the matched packet on 
the first transmission line, a time of receipt of the matched packet on the second transmission 
line, a rate of data transmission on the first transmission line, and a length of the matched 
packet on the first transmission line. 

33. (Original) A method according to claim 32 wherein the first communication line 
transmits data using a first protocol and the second communication line transmits data using a 
second protocol different from the first protocol. 

34. (Original) A method according to claim 31 wherein the transmission delay is 
generated at a level of accuracy less than 10 microseconds. 

35-63. (Canceled). 

64-69. (Canceled). 
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70-71. (Canceled). 
72. (Canceled). 
73-77. (Canceled) 

78. (Previously Presented) A program storage device readable by machine, 
tangibly embodying a program of instructions executable by the machine to perform method 
steps comprising: 

(a) receiving first data from a first communication line; 

(b) segregating the first data into packets; 

(c) generating a statistic corresponding to packets received during each of a 
plurality of successive first time periods, the first time periods having a first duration value; 

(d) separately storing the generated statistics for each of the plurality of 
successive first time periods ; and 

(e) generating a further statistic by aggregating the plurality of stored statistics. 

79. (Previously Presented) A method according to claim 4 comprising selecting 
packets corresponding to communication sessions and step (c) comprises generating a 
number of packets corresponding to unsuccessful communication sessions received during 
each successive first time period. 

80. (Previously Presented) A method for processing data according to claim 79 
wherein the respective type is packets corresponding to TCP sessions and the method 
comprises selecting packets corresponding to TCP sessions and step (c) comprises generating 
a ratio of a quantity of unsuccessful TCP sessions to a quantity of total TCP sessions during a 
time period. 

81. (Previously Presented) A method according to claim 80 wherein the 
unsuccessful TCP sessions are identified to be those TCP sessions that were closed by other 
than a corresponding server. 
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82. (Previously Presented) A method according to claim 11 wherein the 
transmission delay corresponding to each packet is calculated using the equation 

transmission delay = (tsl-ts2)-(link_speed /packetjength) 

where tsl and ts2 are the first and second times, respectively, the link_speed is a data 
rate on the first communication line, and the packetjength is the length of each respective 
packet on the first communication line. 

83. (Previously Presented) A method according to claim 4 wherein the first 
communication line is in a network including a second communication line and the method 
further comprises correlating the packets received from the first communication line to 
packets received from the second communication line. 

84. (Previously Presented) A method according to claim 31 further comprising the 
steps of: 

generating flow statistics based on the flow of data between the first and second 
communication lines; and 

routing further data between the first and second communication lines based on 
the generated flow statistics. 

85. (Previously Presented) A method according to claim 3 wherein the data is 
collected and analyzed by a host computer having a network interface card coupled to the first 
communication line, the method further comprising the steps of: 

requesting an interface clock value from the network interface card; 
generating an adjusted interface clock value by subtracting a predetermined 
service time from the interface clock value; 

providing the adjusted interface clock value to the host computer; 
receiving a host clock value; and 

correlating the adjusted interface clock value with the host clock value. 

86. (Canceled). 



Page 9 of 12 



Appln. No.: 09/863,593 
Amendment Dated: July 5, 2006 
Reply to Office Action of: April 5, 2006 



NIK-100US 



87. (Previously Presented) A system comprising: 

means for receiving first data from a first communication line; 
means for segregating the first data into packets; 

means for generating a statistic corresponding to packets received during each 
of a plurality of successive first time periods, the first time periods having a first duration 
value; 

means for separately storing the generated statistics for each of the plurality of 
successive first time periods; and 

means for generating a further statistic by aggregating the plurality of stored 

statistics. 

88. (Previously Presented) A system comprising: 

a network interface for receiving first data from a first communication line; 
a packetizer for extracting a plurality of packets from the first data; 

a memory; 

a processor for generating a first statistic corresponding to packets received 
during each of a plurality of successive first time periods, the first time periods having a first 
duration value, storing the generated statistics for each of the plurality of successive first time 
periods in the memory/ and generating a second statistic by aggregating the plurality of 
stored statistics. 

89. (Previously Presented) A system according to claim 88 comprising a display 
device for displaying at least one of the first and second statistics. 

90. (Previously Presented) A system according to claim 88 comprising a user 
interface for receiving user input identifying at least one of the first statistics, the second 
statistics, and the first time period. 

91. (Previously Presented) A system according to claim 88 comprising: 
a time source synchronized to an absolute time source; and 

a processor for determining a time when each respective one of the plurality of 
packets was received from the first communication line. 
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92. (Previously Presented) A system according to claim 91 wherein the time source 
is a receiver for receiving a time signal from a global positioning satellite. 

93. (New) The method according to claim 3 wherein the plurality of successive first 
time periods are within a second time period having a duration greater than each first time 
period, the method comprising: 

generating a respective statistic corresponding to packets received during each of a 
plurality of successive first time periods during each of a plurality of successive second time 
periods; 

separately storing the generated statistics for each of the plurality of successive first 
time periods; and 

generating a plurality of further statistics, each by aggregating the plurality of stored 
statistics corresponding to packets received during a corresponding second time period. 
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